@webskill/sdk 0.2.7 → 0.3.0

package/dist/{dist-BdOW8N4V.js → dist-rorEJsNi.js}

@@ -1,7 +1,52 @@
-import { C as messageOf, N as validateSkills, O as renderAvailableSkillsXml, T as parseSkillMarkdown, c as SkillDiscovery, f as assertSafePathSegment, j as resolveInsideRoot, l as SkillReader, m as buildCatalog, u as WebSkillError } from "./dist-BQzncxXg.js";
+import { A as parseSkillMarkdown, L as resolveInsideRoot, O as messageOf, P as renderAvailableSkillsXml, V as validateSkills, f as SkillDiscovery, g as assertSafePathSegment, m as WebSkillError, p as SkillReader, v as buildCatalog } from "./dist-8oQRa8Xz.js";
 import { t as MemoryArtifactStore } from "./memoryArtifactStore-C9lFVqPF-yFz6yJj0.js";
 
 //#region ../runtime/dist/index.js
+function createSseFrameReader() {
+	let buffer = "";
+	let data = [];
+	const dispatch = (out) => {
+		if (data.length === 0) return;
+		out.push(data.join("\n"));
+		data = [];
+	};
+	const consumeLine = (line, out) => {
+		if (line === "") {
+			dispatch(out);
+			return;
+		}
+		if (line.startsWith(":")) return;
+		const colon = line.indexOf(":");
+		if (colon < 0) return;
+		if (line.slice(0, colon) !== "data") return;
+		const value = line.slice(colon + 1);
+		data.push(value.startsWith(" ") ? value.slice(1) : value);
+	};
+	return {
+		push(chunk) {
+			const out = [];
+			buffer += chunk;
+			buffer = buffer.replace(/\r\n/g, "\n");
+			let newline;
+			while ((newline = buffer.indexOf("\n")) >= 0) {
+				const line = buffer.slice(0, newline);
+				buffer = buffer.slice(newline + 1);
+				consumeLine(line, out);
+			}
+			return out;
+		},
+		flush() {
+			const out = [];
+			if (buffer !== "") {
+				const line = buffer;
+				buffer = "";
+				consumeLine(line, out);
+			}
+			dispatch(out);
+			return out;
+		}
+	};
+}
 const toOpenAiMessage = (msg) => {
 	if (msg.role === "tool") return {
 		role: "tool",
@@ -68,7 +113,7 @@ var OpenAiCompatibleClient = class {
 		const toolCallsByIndex = /* @__PURE__ */ new Map();
 		const decoder = new TextDecoder();
 		const reader = res.body.getReader();
-		let buffer = "";
+		const frames = createSseFrameReader();
 		let done = false;
 		const handleFrame = function* (data) {
 			if (data === "[DONE]") {
@@ -104,19 +149,12 @@ var OpenAiCompatibleClient = class {
 		try {
 			for (;;) {
 				const { value, done: readerDone } = await reader.read();
-				if (readerDone) break;
-				buffer += decoder.decode(value, { stream: true });
-				buffer = buffer.replace(/\r\n/g, "\n");
-				let newline;
-				while ((newline = buffer.indexOf("\n")) >= 0) {
-					const line = buffer.slice(0, newline).trim();
-					buffer = buffer.slice(newline + 1);
-					if (line === "" || line.startsWith(":")) continue;
-					if (!line.startsWith("data:")) continue;
-					yield* handleFrame(line.slice(5).trim());
+				const payloads = readerDone ? frames.flush() : frames.push(decoder.decode(value, { stream: true }));
+				for (const payload of payloads) {
+					yield* handleFrame(payload);
 					if (done) break;
 				}
-				if (done) break;
+				if (done || readerDone) break;
 			}
 		} finally {
 			reader.releaseLock();
@@ -125,13 +163,17 @@ var OpenAiCompatibleClient = class {
 			type: "tool-calls",
 			toolCalls: [...toolCallsByIndex.entries()].sort(([a], [b]) => a - b).map(([index, acc]) => {
 				let args = {};
+				let parseError;
 				try {
 					args = JSON.parse(acc.arguments || "{}");
-				} catch {}
+				} catch (e) {
+					parseError = e instanceof Error ? e.message : String(e);
+				}
 				return {
 					id: acc.id || `call-${index}`,
 					name: acc.name,
-					arguments: args
+					arguments: args,
+					...parseError ? { argumentsParseError: parseError } : {}
 				};
 			})
 		};
@@ -292,7 +334,7 @@ var AnthropicClient = class {
 		const toolCallsByIndex = /* @__PURE__ */ new Map();
 		const decoder = new TextDecoder();
 		const reader = res.body.getReader();
-		let buffer = "";
+		const frames = createSseFrameReader();
 		const handleFrame = function* (data) {
 			let chunk;
 			try {
@@ -339,17 +381,9 @@ var AnthropicClient = class {
 		try {
 			for (;;) {
 				const { value, done: readerDone } = await reader.read();
+				const payloads = readerDone ? frames.flush() : frames.push(decoder.decode(value, { stream: true }));
+				for (const payload of payloads) yield* handleFrame(payload);
 				if (readerDone) break;
-				buffer += decoder.decode(value, { stream: true });
-				buffer = buffer.replace(/\r\n/g, "\n");
-				let newline;
-				while ((newline = buffer.indexOf("\n")) >= 0) {
-					const line = buffer.slice(0, newline).trim();
-					buffer = buffer.slice(newline + 1);
-					if (line === "" || line.startsWith(":") || line.startsWith("event:")) continue;
-					if (!line.startsWith("data:")) continue;
-					yield* handleFrame(line.slice(5).trim());
-				}
 			}
 		} finally {
 			reader.releaseLock();
@@ -358,13 +392,17 @@ var AnthropicClient = class {
 			type: "tool-calls",
 			toolCalls: [...toolCallsByIndex.entries()].sort(([a], [b]) => a - b).map(([index, acc]) => {
 				let args = {};
+				let parseError;
 				try {
 					args = JSON.parse(acc.arguments || "{}");
-				} catch {}
+				} catch (e) {
+					parseError = e instanceof Error ? e.message : String(e);
+				}
 				return {
 					id: acc.id || `call-${index}`,
 					name: acc.name,
-					arguments: args
+					arguments: args,
+					...parseError ? { argumentsParseError: parseError } : {}
 				};
 			})
 		};
@@ -520,7 +558,7 @@ var GoogleGenAiClient = class {
 		const toolCalls = [];
 		const decoder = new TextDecoder();
 		const reader = res.body.getReader();
-		let buffer = "";
+		const frames = createSseFrameReader();
 		const handleFrame = function* (data) {
 			let chunk;
 			try {
@@ -548,17 +586,9 @@ var GoogleGenAiClient = class {
 		try {
 			for (;;) {
 				const { value, done: readerDone } = await reader.read();
+				const payloads = readerDone ? frames.flush() : frames.push(decoder.decode(value, { stream: true }));
+				for (const payload of payloads) yield* handleFrame(payload);
 				if (readerDone) break;
-				buffer += decoder.decode(value, { stream: true });
-				buffer = buffer.replace(/\r\n/g, "\n");
-				let newline;
-				while ((newline = buffer.indexOf("\n")) >= 0) {
-					const line = buffer.slice(0, newline).trim();
-					buffer = buffer.slice(newline + 1);
-					if (line === "" || line.startsWith(":") || line.startsWith("event:")) continue;
-					if (!line.startsWith("data:")) continue;
-					yield* handleFrame(line.slice(5).trim());
-				}
 			}
 		} finally {
 			reader.releaseLock();
@@ -1279,6 +1309,51 @@ var TraceRecorder = class {
 		return [...this.#events];
 	}
 };
+/**
+* LLM 可见名 → 作者在 SKILL.md 里写的形态。
+* `<已激活技能>__<脚本>` 保持原样（裸标识符按技能作用域单独匹配），
+* `mcp__x` → `mcp#x`，其余 `a__b` → `endpoint:a/b`。
+*/
+function canonicalToolName(llmToolName, activated) {
+	const sep = llmToolName.indexOf("__");
+	if (sep > 0 && activated.has(llmToolName.slice(0, sep))) return llmToolName;
+	if (llmToolName.startsWith("mcp__")) return `mcp#${llmToolName.slice(5)}`;
+	if (sep > 0) return `endpoint:${llmToolName.slice(0, sep)}/${llmToolName.slice(sep + 2)}`;
+	return llmToolName;
+}
+/**
+* 只支持整段匹配与尾部 `/*`。通配符越自由，作者越容易写出一个自以为很窄、实际很宽的规则；
+* 裸 `endpoint:github`（不带 `/*`）判为未匹配——含糊写法应当报警而不是被善意解释。
+*/
+function matchesPattern(pattern, declaringSkill, llmToolName, canonical) {
+	if (!pattern.includes(":") && !pattern.includes("#")) return llmToolName === `${declaringSkill}__${pattern}`;
+	if (pattern === canonical) return true;
+	if (pattern.endsWith("/*")) {
+		const prefix = pattern.slice(0, -1);
+		return canonical.startsWith(prefix) && canonical.length > prefix.length;
+	}
+	return false;
+}
+function denialReason(state, canonical) {
+	const skills = [...state.skillAllowedTools.keys()].sort().map((s) => `"${s}"`);
+	const subject = skills.length === 1 ? `Skill ${skills[0]} declares` : `Skills ${skills.join(", ")} declare`;
+	const slash = canonical.lastIndexOf("/");
+	return `${subject} allowed-tools, but tool "${canonical}" is not listed. It is still available in 0.3.0 but WILL BE REJECTED in 0.4.0. Add "${canonical}"${slash > 0 ? ` or "${canonical.slice(0, slash)}/*"` : ""} to allowed-tools.`;
+}
+/**
+* 多技能语义：无人声明 → 不受限；有人声明 → 命中任一清单，
+* 或存在一个**未声明**清单的激活技能（否则就是把 A 的声明施加到 B 头上）。
+*/
+function evaluateToolAccess(state, llmToolName) {
+	if (state.skillAllowedTools.size === 0) return { allowed: true };
+	for (const skill of state.activated) if (!state.skillAllowedTools.has(skill)) return { allowed: true };
+	const canonical = canonicalToolName(llmToolName, state.activated);
+	for (const [skill, patterns] of state.skillAllowedTools) for (const pattern of patterns) if (matchesPattern(pattern, skill, llmToolName, canonical)) return { allowed: true };
+	return {
+		allowed: false,
+		reason: denialReason(state, canonical)
+	};
+}
 const MAX_SURFACE_PATCHES_PER_SECOND = 240;
 /** 交互终态（取消/超时）：从工具执行深处直接终止 run */
 var RunTerminated = class extends Error {
@@ -1373,6 +1448,8 @@ var AgentLoop = class {
 			reader: new SkillReader(this.#deps.fs, this.#deps.skillIndex),
 			activated: /* @__PURE__ */ new Set(),
 			activatedTools: /* @__PURE__ */ new Map(),
+			skillAllowedTools: /* @__PURE__ */ new Map(),
+			warnedDeniedTools: /* @__PURE__ */ new Set(),
 			toolTimeoutMs: this.#config.toolTimeoutMs,
 			now,
 			interactionSeq: 0,
@@ -1384,6 +1461,7 @@ var AgentLoop = class {
 			surfacePatchWindowStartedAt: Date.now(),
 			surfacePatchCount: 0,
 			processedSurfaceActionNonces: /* @__PURE__ */ new Set(),
+			emittedToolEvents: /* @__PURE__ */ new Set(),
 			startMs,
 			pausedMs: 0,
 			maxTurns: this.#config.maxTurns,
@@ -1447,6 +1525,19 @@ var AgentLoop = class {
 			state.timer = void 0;
 		}
 	}
+	/**
+	* D10 判定的唯一出口（暴露点 + 分发点共用）。
+	* 0.3.0 只记警告并返回 false，调用点照常放行；0.4.0 收紧时改的是调用点对返回值的处理。
+	*/
+	#checkToolAccess(state, toolName) {
+		const verdict = evaluateToolAccess(state, toolName);
+		if (verdict.allowed) return true;
+		if (!state.warnedDeniedTools.has(toolName)) {
+			state.warnedDeniedTools.add(toolName);
+			state.trace.record("run.warning", { message: verdict.reason ?? `Tool "${toolName}" is not allowed` });
+		}
+		return false;
+	}
 	/** 主循环（run 从第 1 轮、resume 从快照轮次续跑；totalTimeout 以 startedAt 续算） */
 	async #turnLoop(state, startTurn, externalSpecs) {
 		const finish = (status, reason, output, errorCode) => this.#finish(state, status, reason, output, errorCode);
@@ -1458,11 +1549,12 @@ var AgentLoop = class {
 				state.turn = turn;
 				if (turn > state.maxTurns) return finish("failed", "max-turns", `Agent loop exceeded the maximum of ${state.maxTurns} turns`, "RUN_MAX_TURNS_EXCEEDED");
 				if (this.#elapsed(state) > state.totalTimeoutMs) return finish("failed", "timeout", `Agent loop exceeded the total timeout of ${state.totalTimeoutMs}ms`, "RUN_TIMEOUT");
+				const skillToolSpecs = [...[...state.activatedTools.values()].map(toLlmToolSpec), ...externalSpecs];
+				for (const spec of skillToolSpecs) this.#checkToolAccess(state, spec.name);
 				const toolSpecs = [
 					toLlmToolSpec(READ_SKILL_FILE_TOOL),
 					...this.#deps.uiBridge ? [toLlmToolSpec(ASK_USER_TOOL)] : [],
-					...[...state.activatedTools.values()].map(toLlmToolSpec),
-					...externalSpecs
+					...skillToolSpecs
 				];
 				trace.record("llm.request", { data: {
 					turn,
@@ -1592,6 +1684,7 @@ var AgentLoop = class {
 			turn: state.turn,
 			activeSkillNames: [...state.activated].sort(),
 			activatedTools: [...state.activatedTools.values()],
+			...state.skillAllowedTools.size > 0 ? { skillAllowedTools: Object.fromEntries([...state.skillAllowedTools].map(([k, v]) => [k, [...v]])) } : {},
 			...pending.interaction ? { pendingInteraction: pending.interaction } : {},
 			...pending.surfaceAction ? { pendingSurfaceAction: pending.surfaceAction } : {},
 			interactionExpiresAt: state.run.interruptExpiresAt,
@@ -1641,6 +1734,8 @@ var AgentLoop = class {
 			reader: new SkillReader(this.#deps.fs, this.#deps.skillIndex),
 			activated: new Set(snapshot.activeSkillNames),
 			activatedTools: new Map(snapshot.activatedTools.map((d) => [d.name, d])),
+			skillAllowedTools: new Map(Object.entries(snapshot.skillAllowedTools ?? {})),
+			warnedDeniedTools: /* @__PURE__ */ new Set(),
 			toolTimeoutMs: snapshot.config.toolTimeoutMs,
 			now,
 			interactionSeq: snapshot.interactionSeq ?? 0,
@@ -1652,6 +1747,7 @@ var AgentLoop = class {
 			surfacePatchWindowStartedAt: Date.now(),
 			surfacePatchCount: 0,
 			processedSurfaceActionNonces: new Set(snapshot.processedSurfaceActionNonces ?? []),
+			emittedToolEvents: /* @__PURE__ */ new Set(),
 			startMs,
 			pausedMs: snapshot.pausedMs ?? 0,
 			maxTurns: snapshot.config.maxTurns,
@@ -1896,9 +1992,11 @@ var AgentLoop = class {
 		} });
 		this.#emitTool(state, "started", call);
 		let result;
-		if (call.name === "read_skill_file") result = await this.#handleReadSkillFile(call, state);
+		if (call.argumentsParseError) result = toolError("VALIDATION_FAILED", `Tool arguments were not valid JSON: ${call.argumentsParseError}`);
+		else if (call.name === "read_skill_file") result = await this.#handleReadSkillFile(call, state);
 		else if (call.name === "ask_user") result = await this.#handleAskUser(call, state);
 		else {
+			this.#checkToolAccess(state, call.name);
 			const resolution = resolveToolName(call.name, state.activated);
 			if (resolution.kind === "script") result = await this.#handleScriptTool(call, resolution.skillName, resolution.scriptName, state);
 			else {
@@ -2099,8 +2197,18 @@ var AgentLoop = class {
 	* 逐工具实时事件（execute 相位，data.type='tool'）：chatbot 思维链工具行等的 live 状态源；
 	* 与既有 execute 相位事件（{turn}）并存，监听方按 data.type 区分。
 	* data.args 为参数摘要（JSON 截断 100 字符，展开详情用）。
+	*
+	* 幂等：同一 run 内每个 `(callId, status)` 至多投递一次。
+	* 模型在不同轮次重发同一个 tool call id 是真实发生的，消费侧本来各自
+	* 建去重表兑付；幂等是事件流自己的语义，不应该要求每个订阅者重建一次。
+	*
+	* 集合挂在 LoopState 上、**不写进快照**：写进快照会让跨进程恢复的
+	* 消费者永远收不到它本来就没见过的事件。
 	*/
 	#emitTool(state, status, call) {
+		const key = `${call.id}:${status}`;
+		if (state.emittedToolEvents.has(key)) return;
+		state.emittedToolEvents.add(key);
 		this.#deps.eventBus?.emit({
 			phase: "execute",
 			runId: state.runId,
@@ -2253,8 +2361,10 @@ var AgentLoop = class {
 			const rawDeps = metadata["dependencies"];
 			if (Array.isArray(rawDeps)) dependencies = rawDeps.filter((d) => typeof d === "string");
 			const rawAllowed = metadata["allowed-tools"];
-			if (rawAllowed !== void 0) if (Array.isArray(rawAllowed)) allowedTools = rawAllowed.filter((e) => typeof e === "string");
-			else state.trace.record("run.warning", { message: `Skill "${skillName}" has a non-array "allowed-tools" metadata entry; ignored` });
+			if (rawAllowed !== void 0) if (Array.isArray(rawAllowed)) {
+				allowedTools = rawAllowed.filter((e) => typeof e === "string");
+				state.skillAllowedTools.set(skillName, allowedTools);
+			} else state.trace.record("run.warning", { message: `Skill "${skillName}" has a non-array "allowed-tools" metadata entry; ignored` });
 		} catch (e) {
 			state.trace.record("run.warning", { message: `Failed to read or parse SKILL.md of skill "${skillName}": ${messageOf(e)}` });
 		}
@@ -2264,13 +2374,17 @@ var AgentLoop = class {
 			let scriptFiles;
 			try {
 				scriptFiles = (await this.#deps.fs.list(`${root}/scripts`)).filter((s) => s.type === "file").map((s) => baseName(s.path));
-			} catch {
+			} catch (e) {
 				scriptFiles = [];
+				if (!(e instanceof WebSkillError && e.code === "FS_NOT_FOUND")) state.trace.record("run.warning", { message: `Failed to list scripts of skill "${skillName}": ${messageOf(e)}` });
 			}
 			for (const file of scriptFiles) {
 				const match = /^(.*)\.(ts|js)$/.exec(file);
 				if (!match?.[1]) continue;
-				if (allowedTools && !allowedTools.includes(match[1])) continue;
+				if (allowedTools && !allowedTools.includes(match[1])) {
+					state.trace.record("run.warning", { message: `Skill "${skillName}" declares allowed-tools, so its script "${match[1]}" is not registered as a tool. Add "${match[1]}" to allowed-tools if that was not intended.` });
+					continue;
+				}
 				try {
 					const def = await executor.loadDefinition(root, match[1]);
 					await this.#enrichDefinition(root, match[1], def, state);
@@ -2402,10 +2516,11 @@ var AgentLoop = class {
 	#nextInteractionId(state) {
 		return `int-${++state.interactionSeq}`;
 	}
-	async #memoryGet(scope, key) {
+	async #memoryGet(scope, key, state) {
 		try {
 			return await this.#deps.memory?.get(scope, key);
-		} catch {
+		} catch (e) {
+			state.trace.record("run.warning", { message: `Memory read failed: ${messageOf(e)}` });
 			return;
 		}
 	}
@@ -2430,7 +2545,7 @@ var AgentLoop = class {
 			}
 			return;
 		}
-		await this.#memorySet(scope, key, mutate(await this.#memoryGet(scope, key)), state);
+		await this.#memorySet(scope, key, mutate(await this.#memoryGet(scope, key, state)), state);
 	}
 	async #writeActivationMemory(skillName, state) {
 		if (!this.#deps.memory) return;
@@ -2962,9 +3077,26 @@ const encode = (s) => encodeURIComponent(s);
 var FsMemoryStore = class {
 	#root;
 	#fs;
+	#onWarning;
 	constructor(deps) {
 		this.#root = deps.root.replace(/\/+$/, "");
 		this.#fs = deps.fs;
+		this.#onWarning = deps.onWarning ?? ((message) => console.warn(message));
+	}
+	/**
+	* 0.2.8 G2：损坏条目此前直接 remove——静默销毁用户数据，且对调用方伪装成「没有这条记忆」。
+	* 改为隔离到 .corrupt 并告警：run 照常继续，但数据留存、故障可见。
+	*/
+	async #quarantine(path, error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		const target = `${path}.corrupt`;
+		try {
+			await this.#fs.rename(path, target);
+			this.#onWarning(`[webskill] Corrupted memory entry quarantined to ${target}: ${reason}`);
+		} catch (renameError) {
+			const detail = renameError instanceof Error ? renameError.message : String(renameError);
+			this.#onWarning(`[webskill] Corrupted memory entry at ${path} could not be quarantined (${detail}): ${reason}`);
+		}
 	}
 	#scopeDir(scope) {
 		return `${this.#root}/${encode(scope)}`;
@@ -2977,8 +3109,8 @@ var FsMemoryStore = class {
 		if (!await this.#fs.exists(path)) return void 0;
 		try {
 			return JSON.parse(await this.#fs.readText(path));
-		} catch {
-			await this.#fs.remove(path);
+		} catch (e) {
+			await this.#quarantine(path, e);
 			return;
 		}
 	}
@@ -3002,8 +3134,8 @@ var FsMemoryStore = class {
 					key,
 					value: JSON.parse(await this.#fs.readText(entry.path))
 				});
-			} catch {
-				await this.#fs.remove(entry.path);
+			} catch (e) {
+				await this.#quarantine(entry.path, e);
 			}
 		}
 		return out.sort((a, b) => a.key.localeCompare(b.key));
@@ -3018,7 +3150,7 @@ var FsMemoryStore = class {
 		for (const entry of await this.#fs.list(this.#root)) await this.#fs.remove(entry.path, { recursive: true });
 	}
 };
-const INDEX_FILE = "index.json";
+const INDEX_FILE$1 = "index.json";
 /**
 * 基于 FileSystemProvider 的 ArtifactStore：产物落盘 <root>/<runId>/<path>，
 * 每次写入同步更新 <root>/<runId>/index.json，新实例可凭索引恢复列表。
@@ -3027,9 +3159,11 @@ const INDEX_FILE = "index.json";
 var FsArtifactStore = class {
 	#root;
 	#fs;
+	#onWarning;
 	constructor(deps) {
 		this.#root = deps.root.replace(/\/+$/, "");
 		this.#fs = deps.fs;
+		this.#onWarning = deps.onWarning ?? ((message) => console.warn(message));
 	}
 	async createTextArtifact(input) {
 		const size = new TextEncoder().encode(input.content).length;
@@ -3050,13 +3184,20 @@ var FsArtifactStore = class {
 	}
 	async listArtifacts(runId) {
 		assertSafePathSegment(runId, "runId");
-		const indexPath = `${this.#root}/${runId}/${INDEX_FILE}`;
+		const indexPath = `${this.#root}/${runId}/${INDEX_FILE$1}`;
 		if (!await this.#fs.exists(indexPath)) return [];
 		const raw = await this.#fs.readText(indexPath);
 		try {
 			return JSON.parse(raw).artifacts ?? [];
-		} catch {
-			await this.#fs.remove(indexPath);
+		} catch (e) {
+			const reason = e instanceof Error ? e.message : String(e);
+			try {
+				await this.#fs.rename(indexPath, `${indexPath}.corrupt`);
+				this.#onWarning(`[webskill] Corrupted artifact index for run ${runId} quarantined to ${indexPath}.corrupt: ${reason}`);
+			} catch (renameError) {
+				const detail = renameError instanceof Error ? renameError.message : String(renameError);
+				this.#onWarning(`[webskill] Corrupted artifact index for run ${runId} could not be quarantined (${detail}): ${reason}`);
+			}
 			return [];
 		}
 	}
@@ -3076,7 +3217,7 @@ var FsArtifactStore = class {
 			metadata: input.metadata
 		};
 		const next = [...(await this.listArtifacts(input.runId)).filter((a) => a.id !== artifact.id), artifact];
-		await this.#fs.writeText(`${this.#root}/${input.runId}/${INDEX_FILE}`, JSON.stringify({ artifacts: next }, null, 2));
+		await this.#fs.writeText(`${this.#root}/${input.runId}/${INDEX_FILE$1}`, JSON.stringify({ artifacts: next }, null, 2));
 		return artifact;
 	}
 };
@@ -3170,6 +3311,20 @@ function networkUrlHost(url) {
 		return "(unparseable-url)";
 	}
 }
+/**
+* 网络策略判定逻辑的可注入源码（单一来源）。
+*
+* 0.2.8 C4：此前各注入点直接拼 `isNetworkAllowed.toString()`，依赖**函数名在产物里保持不变**。
+* SDK 自身不压缩，但消费方一旦跑生产构建，打包器会把导出函数改名（`function Ke(...)`），
+* 注入后的沙箱里 `isNetworkAllowed` 就是 undefined —— 沙箱内任何 fetch 直接
+* TOOL_EXECUTION_FAILED，网络白名单形同虚设。dev server 不压缩，所以只在真实产物上暴露。
+*
+* 因此改为把函数源码绑定到**固定的变量名**上：`var isNetworkAllowed = function Ke(...) {…};`
+* ——名字随便压缩，绑定名恒定。两个函数都自包含（不引用模块内其它符号），故可独立绑定。
+*/
+function networkPolicyLibSource() {
+	return `var isNetworkAllowed = ${isNetworkAllowed.toString()};\nvar networkUrlHost = ${networkUrlHost.toString()};`;
+}
 /** WebSkillErrorCode 全量白名单（错误码归一用；与 core errors.ts 保持同步） */
 const WHITELIST = /* @__PURE__ */ new Set([
 	"FS_NOT_FOUND",
@@ -3281,6 +3436,388 @@ var CapabilityApproval = class CapabilityApproval {
 		return "allowed";
 	}
 };
+const RUN_TRACE_SCHEMA_VERSION = 1;
+/** 终止原因：取最后一条 run.completed/cancelled/failed 事件的 data.reason */
+function extractEndReason(events) {
+	for (let i = events.length - 1; i >= 0; i--) {
+		const event = events[i];
+		if (event.type === "run.completed" || event.type === "run.cancelled" || event.type === "run.failed") {
+			const reason = event.data?.["reason"];
+			return typeof reason === "string" ? reason : void 0;
+		}
+	}
+}
+function summarize(trace) {
+	const endReason = extractEndReason(trace.events);
+	const durationMs = trace.endedAt === void 0 ? void 0 : Date.parse(trace.endedAt) - Date.parse(trace.startedAt);
+	return {
+		runId: trace.runId,
+		startedAt: trace.startedAt,
+		status: trace.status,
+		activeSkills: trace.activeSkills,
+		eventCount: trace.events.length,
+		turnCount: trace.events.filter((e) => e.type === "llm.request").length,
+		...trace.sessionId !== void 0 ? { sessionId: trace.sessionId } : {},
+		...trace.endedAt !== void 0 ? { endedAt: trace.endedAt } : {},
+		...endReason !== void 0 ? { endReason } : {},
+		...durationMs !== void 0 && Number.isFinite(durationMs) && durationMs >= 0 ? { durationMs } : {}
+	};
+}
+function parseTraceFile(raw, path) {
+	let data;
+	try {
+		data = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (typeof data !== "object" || data === null) return void 0;
+	if (typeof data.runId !== "string" || typeof data.startedAt !== "string") return void 0;
+	const schemaVersion = typeof data.schemaVersion === "number" ? data.schemaVersion : 0;
+	if (schemaVersion > 1) throw new WebSkillError("RUN_TRACE_INCOMPATIBLE", `Run trace "${path}" declares schemaVersion ${schemaVersion}, which is newer than the supported 1`);
+	return {
+		schemaVersion,
+		runId: data.runId,
+		...typeof data.sessionId === "string" ? { sessionId: data.sessionId } : {},
+		startedAt: data.startedAt,
+		...typeof data.endedAt === "string" ? { endedAt: data.endedAt } : {},
+		status: typeof data.status === "string" ? data.status : "unknown",
+		activeSkills: Array.isArray(data.activeSkills) ? data.activeSkills.filter((s) => typeof s === "string") : [],
+		events: Array.isArray(data.events) ? data.events : []
+	};
+}
+const INDEX_FILE = "index.jsonl";
+/**
+* `FileSystemProvider` 后端：`<root>/<runId>.json` 存全量 trace，
+* `<root>/index.jsonl` 是 append-only 的摘要旁路索引。
+*
+* 索引存在的唯一理由是**读次数**：0.0.1 的实现为了拼一份列表要整读每个 trace
+* 文件，点一次指标再来一遍。有了索引，`list()` 与 `metrics()` 各只读一个文件。
+*
+* 索引与 trace 目录发散（写完 trace 崩在追加前）的检测不引入新的读放大：
+* 目录列举本来就要做，比较 `*.json` 个数与索引行数即可；不等则整体重建。
+* @stable
+*/
+var FsRunTraceStore = class {
+	#root;
+	#fs;
+	#onError;
+	constructor(deps) {
+		this.#root = deps.root.replace(/\/+$/, "");
+		this.#fs = deps.fs;
+		this.#onError = deps.onError ?? ((error, run) => {
+			console.warn(`Failed to persist run trace "${run.id}": ${messageOf(error)}`);
+		});
+	}
+	#path(runId) {
+		return resolveInsideRoot(this.#root, `${runId}.json`);
+	}
+	async put(run) {
+		const trace = {
+			schemaVersion: 1,
+			runId: run.id,
+			sessionId: run.sessionId,
+			startedAt: run.startedAt,
+			...run.endedAt !== void 0 ? { endedAt: run.endedAt } : {},
+			status: run.status === "completed" || run.status === "cancelled" ? run.status : "failed",
+			activeSkills: run.activeSkillNames,
+			events: run.trace
+		};
+		try {
+			await this.#fs.writeText(this.#path(run.id), JSON.stringify(trace, null, 2));
+			await this.#fs.appendText(`${this.#root}/${INDEX_FILE}`, `${JSON.stringify(summarize(trace))}\n`);
+		} catch (e) {
+			this.#onError(e, run);
+		}
+	}
+	async get(runId) {
+		assertSafePathSegment(runId, "run id");
+		const path = this.#path(runId);
+		let raw;
+		try {
+			raw = await this.#fs.readText(path);
+		} catch (e) {
+			if (e instanceof WebSkillError) throw e;
+			throw new WebSkillError("FS_NOT_FOUND", `Trace not found for run ${JSON.stringify(runId)}: ${path}`);
+		}
+		const trace = parseTraceFile(raw, path);
+		if (!trace) throw new WebSkillError("VALIDATION_FAILED", `Trace file is corrupted or malformed: ${path}`);
+		return trace;
+	}
+	async list(filter = {}) {
+		const { summaries } = await this.#readIndex();
+		const matched = applyFilter(summaries, filter);
+		const offset = Math.max(0, filter.offset ?? 0);
+		const sliced = matched.slice(offset);
+		return filter.limit !== void 0 ? sliced.slice(0, Math.max(0, filter.limit)) : sliced;
+	}
+	async metrics(filter = {}) {
+		const { summaries, skipped } = await this.#readIndex();
+		const runs = applyFilter(summaries, filter);
+		const succeeded = runs.filter((r) => r.status === "completed").length;
+		const failedRuns = runs.filter((r) => r.status === "failed");
+		const durations = runs.map((r) => r.durationMs).filter((ms) => ms !== void 0);
+		return {
+			totalRuns: runs.length,
+			succeeded,
+			failed: failedRuns.length,
+			successRate: runs.length === 0 ? 0 : succeeded / runs.length,
+			avgTurns: runs.length === 0 ? 0 : runs.reduce((sum, r) => sum + r.turnCount, 0) / runs.length,
+			skippedRuns: skipped,
+			avgDurationMs: durations.length === 0 ? 0 : durations.reduce((a, b) => a + b, 0) / durations.length,
+			recentFailures: failedRuns.slice(0, 5)
+		};
+	}
+	/** 健康路径恒为「一次目录列举 + 一次索引读」，与 run 数无关。 */
+	async #readIndex() {
+		if (!await this.#fs.exists(this.#root)) return {
+			summaries: [],
+			skipped: 0
+		};
+		const traceCount = (await this.#fs.list(this.#root)).filter((f) => f.type === "file" && f.path.endsWith(".json")).length;
+		const indexPath = `${this.#root}/${INDEX_FILE}`;
+		let lines = [];
+		if (await this.#fs.exists(indexPath)) lines = (await this.#fs.readText(indexPath)).split("\n").filter((line) => line.trim() !== "");
+		if (lines.length !== traceCount) return {
+			summaries: await this.#rebuildIndex(),
+			skipped: 0
+		};
+		const summaries = [];
+		let skipped = 0;
+		for (const line of lines) try {
+			summaries.push(JSON.parse(line));
+		} catch {
+			skipped += 1;
+		}
+		if (skipped > 0) return {
+			summaries: await this.#rebuildIndex(),
+			skipped
+		};
+		return {
+			summaries: sortByStartedAtDesc(summaries),
+			skipped: 0
+		};
+	}
+	/** 异常路径，允许 O(N)：整读全部 trace 文件后用 temp + rename 原子替换索引 */
+	async #rebuildIndex() {
+		const summaries = [];
+		for (const entry of await this.#fs.list(this.#root)) {
+			if (entry.type !== "file" || !entry.path.endsWith(".json")) continue;
+			let trace;
+			try {
+				trace = parseTraceFile(await this.#fs.readText(entry.path), entry.path);
+			} catch {
+				continue;
+			}
+			if (!trace) continue;
+			summaries.push(summarize(trace));
+		}
+		const sorted = sortByStartedAtDesc(summaries);
+		const indexPath = `${this.#root}/${INDEX_FILE}`;
+		const tempPath = `${this.#root}/${INDEX_FILE}.rebuilding`;
+		try {
+			await this.#fs.writeText(tempPath, sorted.map((s) => `${JSON.stringify(s)}\n`).join(""));
+			await this.#fs.rename(tempPath, indexPath);
+		} catch {
+			await this.#fs.remove(tempPath).catch(() => void 0);
+		}
+		return sorted;
+	}
+};
+/** ISO 时间戳可按字典序比较 */
+function sortByStartedAtDesc(summaries) {
+	return [...summaries].sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+}
+function applyFilter(summaries, filter) {
+	let runs = summaries;
+	if (filter.status !== void 0 && filter.status !== "") runs = runs.filter((r) => r.status === filter.status);
+	const q = filter.search?.trim().toLowerCase();
+	if (q !== void 0 && q !== "") runs = runs.filter((r) => r.runId.toLowerCase().includes(q) || r.activeSkills.some((s) => s.toLowerCase().includes(q)));
+	return runs;
+}
+/**
+* 从 run 的 trace 推导终态工具调用列表。
+*
+* 消费者过去要靠自己遍历 trace 才能拿到这份列表，而遍历 trace 的同一段代码
+* 又顺手承担了「补发漏掉的 live 事件」的职责——两件事绑在一起，谁也删不掉。
+* 幂等归 runtime（见 `AgentLoop` 的 per-run 已发集合）之后，
+* 推导终态列表就是纯函数，独立导出。
+* @stable
+*/
+function summarizeToolCalls(run) {
+	const calls = [];
+	for (const event of run.trace) {
+		if (event.type !== "tool.completed" && event.type !== "tool.failed") continue;
+		const name = event.data?.["name"];
+		const callId = event.data?.["callId"];
+		if (typeof name !== "string" || typeof callId !== "string") continue;
+		const args = event.data?.["args"];
+		const durationMs = event.data?.["durationMs"];
+		calls.push({
+			callId,
+			name,
+			status: event.type === "tool.completed" ? "completed" : "failed",
+			...typeof args === "string" ? { args } : {},
+			...typeof durationMs === "number" ? { durationMs } : {}
+		});
+	}
+	return calls;
+}
+const SESSION_SCHEMA_VERSION = 1;
+const toMeta = (record) => ({
+	id: record.id,
+	createdAt: record.createdAt,
+	...record.title !== void 0 ? { title: record.title } : {},
+	...record.titleLocked === true ? { titleLocked: true } : {},
+	...record.archived === true ? { archived: true } : {},
+	messageCount: record.messages.length
+});
+const newSessionId = () => `session-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+/**
+* 解析会话文件。缺 `schemaVersion` 视为 0（0.0.1 时代文件，兼容读）；
+* 高于当前版本拒绝读，避免新版写的字段被旧版静默丢弃。
+*/
+function parseSessionFile(raw, path) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (e) {
+		throw new WebSkillError("VALIDATION_FAILED", `Session file is not valid JSON: ${path}`, e);
+	}
+	if (typeof parsed !== "object" || parsed === null) throw new WebSkillError("VALIDATION_FAILED", `Session file is not an object: ${path}`);
+	const file = parsed;
+	const schemaVersion = typeof file.schemaVersion === "number" ? file.schemaVersion : 0;
+	if (schemaVersion > 1) throw new WebSkillError("SESSION_INCOMPATIBLE", `Session file at ${path} has schemaVersion ${schemaVersion}, but this build understands at most 1`);
+	if (typeof file.id !== "string" || typeof file.createdAt !== "string") throw new WebSkillError("VALIDATION_FAILED", `Session file is missing "id" or "createdAt": ${path}`);
+	return {
+		schemaVersion,
+		id: file.id,
+		createdAt: file.createdAt,
+		...typeof file.title === "string" ? { title: file.title } : {},
+		...file.titleLocked === true ? { titleLocked: true } : {},
+		...file.archived === true ? { archived: true } : {},
+		messages: Array.isArray(file.messages) ? file.messages : [],
+		messageCount: Array.isArray(file.messages) ? file.messages.length : 0
+	};
+}
+/**
+* `FileSystemProvider` 后端的会话存储：`<root>/<id>.json`。
+*
+* 所有变更操作按 id 串到一条 promise 链上：会话文件是整读整写的，
+* 两个并发 `appendMessages` 若都先读后写，后写的会覆盖先写的那条消息。
+*/
+var FsSessionStore = class {
+	#root;
+	#fs;
+	/** id → 该 id 上最后一次变更的完成时点，用于串行化读改写 */
+	#writes = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.#root = deps.root.replace(/\/+$/, "");
+		this.#fs = deps.fs;
+	}
+	#path(id) {
+		assertSafePathSegment(id, "session id");
+		return resolveInsideRoot(this.#root, `${id}.json`);
+	}
+	/** 把 mutation 排到该 id 的队尾；前一个失败不阻塞后一个 */
+	async #serialize(id, work) {
+		const next = (this.#writes.get(id) ?? Promise.resolve()).catch(() => void 0).then(work);
+		this.#writes.set(id, next);
+		try {
+			return await next;
+		} finally {
+			if (this.#writes.get(id) === next) this.#writes.delete(id);
+		}
+	}
+	async #write(record) {
+		const file = {
+			schemaVersion: 1,
+			id: record.id,
+			createdAt: record.createdAt,
+			...record.title !== void 0 ? { title: record.title } : {},
+			...record.titleLocked === true ? { titleLocked: true } : {},
+			...record.archived === true ? { archived: true } : {},
+			messages: record.messages
+		};
+		await this.#fs.writeText(this.#path(record.id), JSON.stringify(file, null, 2));
+	}
+	async #require(id) {
+		const record = await this.get(id);
+		if (!record) throw new WebSkillError("FS_NOT_FOUND", `Session "${id}" not found under ${this.#root}`);
+		return record;
+	}
+	async list(options = {}) {
+		if (!await this.#fs.exists(this.#root)) return [];
+		const metas = [];
+		for (const entry of await this.#fs.list(this.#root)) {
+			if (entry.type !== "file" || !entry.path.endsWith(".json")) continue;
+			let record;
+			try {
+				record = parseSessionFile(await this.#fs.readText(entry.path), entry.path);
+			} catch (e) {
+				console.warn(`Skipping unreadable session file "${entry.path}": ${e instanceof Error ? e.message : String(e)}`);
+				continue;
+			}
+			if (record.archived === true && options.includeArchived !== true) continue;
+			metas.push(toMeta(record));
+		}
+		return metas.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+	}
+	async get(id) {
+		const path = this.#path(id);
+		if (!await this.#fs.exists(path)) return void 0;
+		return parseSessionFile(await this.#fs.readText(path), path);
+	}
+	async create(init = {}) {
+		const record = {
+			schemaVersion: 1,
+			id: init.id ?? newSessionId(),
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			...init.title !== void 0 ? { title: init.title } : {},
+			messages: [],
+			messageCount: 0
+		};
+		return this.#serialize(record.id, async () => {
+			await this.#write(record);
+			return toMeta(record);
+		});
+	}
+	async appendMessages(id, messages) {
+		if (messages.length === 0) return;
+		await this.#serialize(id, async () => {
+			const record = await this.#require(id);
+			record.messages.push(...messages);
+			await this.#write(record);
+		});
+	}
+	async replaceMessages(id, messages) {
+		await this.#serialize(id, async () => {
+			const record = await this.#require(id);
+			record.messages = [...messages];
+			await this.#write(record);
+		});
+	}
+	async setTitle(id, title, options = {}) {
+		await this.#serialize(id, async () => {
+			const record = await this.#require(id);
+			record.title = title;
+			if (options.lock === true) record.titleLocked = true;
+			await this.#write(record);
+		});
+	}
+	async setArchived(id, archived) {
+		await this.#serialize(id, async () => {
+			const record = await this.#require(id);
+			record.archived = archived;
+			await this.#write(record);
+		});
+	}
+	async delete(id) {
+		await this.#serialize(id, async () => {
+			const path = this.#path(id);
+			if (await this.#fs.exists(path)) await this.#fs.remove(path);
+		});
+	}
+};
 
 //#endregion
-export { fromVercelStreamPart as A, toLlmToolSpec as B, bridgeError as C, extractChartSpec as D, createWebSkillApi as E, normalizeToolContent as F, validateUiSurface as H, normalizeToolError as I, parseBridgeRequest as L, mergeCatalogEntries as M, networkUrlHost as N, extractUiSurfaceEvents as O, normalizeErrorCode as P, resolveToolName as R, WebSkillRuntime as S, createScriptContext as T, validateUiSurfaceEvent as U, toVercelToolSpecs as V, READ_SKILL_FILE_TOOL as _, AnthropicClient as a, SerializingMemoryStore as b, FsArtifactStore as c, FullDisclosureRouter as d, GoogleGenAiClient as f, READ_SKILL_FILE_INPUT_SCHEMA as g, ProgressiveRouter as h, AgentLoop as i, isNetworkAllowed as j, fromVercelResult as k, FsMemoryStore as l, OpenAiCompatibleClient as m, ASK_USER_TOOL as n, CapabilityApproval as o, HookRunner as p, ASK_USER_TOOL_NAME as r, EventBus as s, ASK_USER_INPUT_SCHEMA as t, FsRunSnapshotStore as u, READ_SKILL_FILE_TOOL_NAME as v, buildRenderResult as w, TraceRecorder as x, RUN_SNAPSHOT_SCHEMA_VERSION as y, schemaToForm as z };
+export { createWebSkillApi as A, normalizeToolContent as B, SESSION_SCHEMA_VERSION as C, bridgeError as D, WebSkillRuntime as E, isNetworkAllowed as F, summarizeToolCalls as G, parseBridgeRequest as H, mergeCatalogEntries as I, validateUiSurface as J, toLlmToolSpec as K, networkPolicyLibSource as L, extractUiSurfaceEvents as M, fromVercelResult as N, buildRenderResult as O, fromVercelStreamPart as P, networkUrlHost as R, RUN_TRACE_SCHEMA_VERSION as S, TraceRecorder as T, resolveToolName as U, normalizeToolError as V, schemaToForm as W, validateUiSurfaceEvent as Y, ProgressiveRouter as _, AnthropicClient as a, READ_SKILL_FILE_TOOL_NAME as b, FsArtifactStore as c, FsRunTraceStore as d, FsSessionStore as f, OpenAiCompatibleClient as g, HookRunner as h, AgentLoop as i, extractChartSpec as j, createScriptContext as k, FsMemoryStore as l, GoogleGenAiClient as m, ASK_USER_TOOL as n, CapabilityApproval as o, FullDisclosureRouter as p, toVercelToolSpecs as q, ASK_USER_TOOL_NAME as r, EventBus as s, ASK_USER_INPUT_SCHEMA as t, FsRunSnapshotStore as u, READ_SKILL_FILE_INPUT_SCHEMA as v, SerializingMemoryStore as w, RUN_SNAPSHOT_SCHEMA_VERSION as x, READ_SKILL_FILE_TOOL as y, normalizeErrorCode as z };